Many embedded systems security and reliability features are integrated in-band, or handled by an external support mechanism with limited access. In-band methods usually include some sort of kernel-level program, or a separate real time task that offers binary encryption, checksums, digital signing or prevent tampering and debugging. While these mitigations are useful, they are usually fixed and reside with the functional code being monitored. This leads to a few problems, one being a lack of updates which enable responding to new threats. Additionally responses are limited to a few options, such as preventing a binary from running or restoring a part of the system to a known-good state, only for it to be corrupted again. Disabling or tampering with the in-band monitor is another potential problem.
External subsystems benefit from being out-of-band. Hardware such as trusted platform modules (TPMs) or watchdogs, often provide reliable static protections like trusted boot services, cryptographic functions, or heartbeat detection. However, they offer minimal proactive problem detection and resolutions. If an issue is detected, either the system self-corrects using predefined methods, the system will not boot, or the system is restarted.
More complex systems have been created, but are frequently limited by data throughput or processing capabilities, or they require some assumed trust of device not present on the SoC die. While these tradeoffs were sufficient ten years ago, they are outclassed today in the face of nation state actors.
Two problems from the outset of the current art are: 1) high levels of integration of today's modern processors, and 2) their closed IP nature. Processors are still not developer friendly and have many closed-source components. Software drivers are also an issue and are frequently provided as binary blobs, unless large licensing fees are paid.
High levels of integration are excellent from a cost and power consumption point of view, however cause problems when researchers attempt to observe interactions between components within the SoC. Furthermore, the security of SoCs is sometimes questioned due to the integrated baseband and management features typically included.